• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.5
• /
• pp.1099-1105
• /
• 2017

Enterprises use different accounting programs to process vast amounts of accounting data. Due to the characteristic of the accounting program, in addition to the accounting data used by the accounting program, there is a variety of information to help detect accounting fraud. Existing forensic accounting techniques have limited scope of analysis because they analyze only accounting data like accounting ledger without using such information. When you do accounting fraud detection, information obtained from characteristics of accounting program can be used to obtain various information that can not be obtained by accounting data analysis alone. In this paper, we try to contribute to effective accounting fraud investigation by suggesting a technique to effectively detect accounting fraud by using other data obtained from characteristics of accounting program used in Windows system.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2011.06a
• /
• pp.197-201
• /
• 2011

검찰과 경찰에서는 압수수색을 통해 조사를 수행하는데, 기업들은 압수수색 수사를 받기 전에 회계 DB 및 회계 관련 파일 삭제, 파손 및 은닉하는 등의 문제점을 발생시키고 있다. 2008년 삼성화재 비자금 조성 사건과, 2009년 교하 복합커뮤니티 센터의 입찰비리 사건 등 기업회계장부의 포렌식 기술적용방법 문제 등이 발생하고 있다. 본 논문에서는 포렌식 수사 도구인 EnCase, FinalData 등을 연구하고, 기업의 회계 서버에 대해 압수수색 준비와 압수 수색, 획득 증거 분석 등의 절차를 연구한다. 기업의 회계 서버 압수수색 후에 디스크에서 포렌식 증거분석에서 실시되는 증거물 원본 파일보관, 원본성이 입증된 사본생성, 삭제 파일 검사 및 복원, 삭제 내용 확인, 원본 파일과의 대조를 실험을 한다. 본 연구 결과는 포렌식 기술발전에 기여하게 될 것이다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2011.06a
• /
• pp.207-211
• /
• 2011

기업들의 비자금 수사를 받기 전에 압수수색 대상 회계 파일의 삭제, 파손 및 은닉하고 있다. 2010년 H 그룹 비자금 조성 사건에서도 삭제된 파일에서 회계처리, 비자금 문제를 발견하였다. 최근에는 Smart Phone의 활성화와 함께 주요 증거물을 Smart Phone에 저장하고 업무를 진행하고 있다. 본 논문에서는 압수수색된 Smart Phone에서 기업의 회계장부를 찾아내고, 삭제한 회계장부를 복원하는 포렌식 수사기술에 관한 연구이다. 기업에 대한 압수수색 준비와 압수 수색, 획득 증거 분석 등의 절차와 포렌식 도구들을 분석한다. Smart Phone 압수수색 후 포렌식 증거 자료 추출 과정과 포렌식 도구를 이용하여 실험하고 포렌식 증거자료를 추출한다. 본 논문을 통해서 Smart Phone 포렌식 기술발전에 기여 하고자 한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.4
• /
• pp.851-868
• /
• 2012

After the financial crisis in 2008, the financial market still seems to be unstable with expanding the insolvency of the financial companies' real estate project financing loan in the aftermath of the lasted real estate recession. Especially after the illegal actions of people's financial institutions disclosed, while increased the anxiety of economic subjects about financial markets and weighted in the confusion of financial markets, the potential risk for the overall national economy is increasing. Thus as economic recession prolongs, the people's financial institutions having a weak profit structure and financing ability commit illegal acts in a variety of ways in order to conceal insolvent assets. Especially it is hard to find the loans of shareholder and the same borrower sharing credit risk in advance because most of them usually use a third-party's name bank account. Therefore, in order to effectively detect the fraud under other's name, it is necessary to analyze by clustering the borrowers high-related to a particular borrower through an analysis of association between the whole borrowers. In this paper, we introduce Analysis Techniques for detecting financial loan frauds in advance through an analysis of association between the whole borrowers by extending SNA(social network analysis) which is being studied by focused on sociology recently to the forensic accounting field of the financial frauds. Also this technique introduced in this pager will be very useful to regulatory authorities or law enforcement agencies at the field inspection or investigation.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.3
• /
• pp.565-573
• /
• 2012

To investigate the business corruption, the obtainments of the business data such as personnel, manufacture, accounting and distribution etc., is absolutely necessary. Futhermore, the investigator should have the systematic extraction solution from the business data of the enterprise database, because most company manage each business data through the distributed database system, In the general business environment, the database exists in the system with upper layer application and big size file server. Besides, original resource data which input by user are distributed and stored in one or more table following the normalized rule. The earlier researches of the database structure analysis mainly handled the table relation for database's optimization and visualization. But, in the point of the digital forensic, the data, itself analysis is more important than the table relation. This paper suggests the extraction technique from the table relation which already defined in the database. Moreover, by the systematic analysis process based on the domain knowledge, analyzes the original business data structure stored in the database and proposes the solution to extract table which is related incident.